Dirty payments: where the fintech market is headed with the Worldline investigation

In June, journalists from the European Investigative Collaborations (EIC), along with two dozen media outlets, published a Dirty Payments investigation centered on French payment operator Worldline. Investigators allege that the company and its subsidiaries spent years serving customers from high-risk industries ranging from online casinos and pornography to pseudo-legal financial services, ignoring internal whistleblowing. The publication triggered the sharpest biggest stock drop in Worldline's history -almost 40% in a day. How did it expose the weaknesses of the fintech market?  

Founded in 1972 as the IT arm of the Crédit Lyonnais bank, the company went through a series of mergers (Sligos, Axime, Atos Origin) before spinning off as a standalone company in 2014 as Worldline. 

Its shares have been traded on the Paris stock exchange since 2014. Among the largest shareholders as of 2024 are Switzerland's SIX Group, Crédit Agricole, and French state fund Bpifrance - none of whom hold a controlling stake. Worldline now provides infrastructure solutions for online and offline payments, including acquiring, card issuance, fraud protection and payment process support for 1.45 million merchants and hundreds of banks worldwide. By 2024, Worldline's revenue will reach €4.63 billion.

Consumers interact with its solutions indirectly - through terminals in stores, ATMs, Internet payments and transportation systems - without even realizing that their transactions are processed by this French company. In fact, Worldline is the "behind-the-scenes operator": thousands of services across Europe depend on its stability, it provides routing, security and settlements between banks;

In 2020, Worldline acquired its competitor Ingenico for €7.8 billion, becoming one of the largest players in the EU acquiring market. In 2024, the company made a strategic partnership with Google, beginning to migrate its systems to the Google Cloud platform.

However, behind the facade of technology, systemic problems were accumulating. Since 2022, Worldline's subsidiaries in Germany and the Netherlands have been subject to regulatory complaints.

Germany's BaFin banned Payone (a subsidiary of Worldline, a payment provider in Germany and Austria) from dealing with high-risk customers: an audit found that Payone did not comply with anti-money laundering laws and did not sufficiently screen its customers. The Dutch central bank also discovered insufficient controls at Global Collect Services, a subsidiary of Worldline. 

Journalists in the Dirty Payments investigation uncover several schemes through which Worldline and its subsidiary Payone allegedly served high-risk customers for years and deliberately circumvented internal controls. The list of suspicious transactions includes companies linked to online casinos, phishing and porn sites. 

The investigation was based on interviews with former Worldline employees and an analysis of public databases, court filings, and thousands of internal company documents: correspondence, presentations, risk reports, and customer lists from nearly a decade.

Here are a few schemes linked to Aether Group (formerly Linkmedia). The company had offices in Dubai, suburban Manila, and Bishkek (with software developers sitting in the Kyrgyz capital). According to investigators, Aether Group operated a network of more than 100 fake companies in the UK. They ran hundreds of websites masquerading as online shopping and dating services. Among the schemes uncovered were fake contests and pages with "unbelievable discounts," subscription traps where a one-time purchase was replaced by an expensive subscription, fake QR codes on parking meters that led to sites that stole bank card data. 

Journalists estimate that in 2023, over over 45 million pounds was passed through Worldline and its structures in favor of these shell companies. Aether Group categorically denies any involvement in illegal or fraudulent activity, saying it only created websites for clients, but did not own them.

Another figure in the investigation is European online pornography kingpin David Adzatto. The Swiss publication WOZ wrote that 15,000 escort workers, mostly women, were registered on one of the portals associated with him. This resource was used by criminal networks that forced people, including minors (the publication writes about a 12-year-old girl) to work in the sex industry. Investigative journalists found that in 2023, transactions for nine Adzatto companies totaling about 31 million euros were processed precisely through Worldline. 

An NRC investigation showed that Global Collect Services' clients, for example, included an Indian company that sold fraudulent software to people - they received pop-up messages on their computers with a fake "virus warning."

The authors of the investigation also drew attention to the accelerated procedure of connecting new clients: for example, hundreds of new companies from the high business risk sector were connected to the system within two weeks - without full verification and identification of beneficiaries. As The Bureau of Investigative Journalism emphasizes, some of these clients later filed in criminal cases in Europe;

In some cases, the company's divisions themselves recorded problems with customers, but did not stop working with them, but transferred them to other legal entities within the Worldline group. Journalists confirm that senior managers, in correspondence with risk management staff, insisted on processing dubious online transactions, the total volume of which was up to €500 million a year. 

All of this data, according to journalists, shows that within Worldline compliance was just an appearance. Risks were regularly recorded and documented, but nothing further happened: the company continued to work with high-risk clients "because they provided good profits". 

Worldline did not comment on specific facts from the investigation. It stated that it has a "zero tolerance" for violations and strictly adheres to all compliance regulations.

From its statement, it has audited its high-risk customers since 2023. They now account for about 1.5% of total transaction volume. The company has severed relationships with companies that did not comply with the updated risk management framework - in total, they accounted for €130 million of projected annual revenue in 2024. The company believes that internal procedures are now aligned with regulatory requirements. 

Following the publication of the Dirty Payments investigation, Worldline CEO Pierre-Antoine Vacheron wrote that there was "nothing new" in the published material and called the investigation a "media attack" and an "unacceptable narrative." According to Bloomberg, company executives are considering filing a lawsuit against the EIC journalism network, which coordinated the investigation. 

Investors' reaction to the publication of the Dirty Payments investigation was immediate. Shares of Worldline on June 25 fell by 40% in one day. By the current moment, the company's securities have not fully recovered this fall;

Now one of the main intrigues is the reaction of strategic partners, particularly French bank Crédit Agricole, which formed a joint venture with Worldline in 2022 and acquired a 7% stake in the company in 2024. Inside the bank, a wave of employee discontent began: they sent inquiries to the board about whether a full due diligence process had been conducted before the deal.

Australian bank ANZ, which owns a joint venture with Worldline from 2020, has accelerated the process of buying back its stake to minimize risk to its own brand, according to Capital Brief. Discussions about this began as early as December 2024, but the scandal surrounding Worldline has "added urgency" to the process, according to the publication's sources.

Financial services firm Oddo BHF downgraded Worldline's stock from "neutral" to "underperform" and halved its target price from €5 to €2.5, citing "a serious controversy identified by the EIC network regarding large-scale suspicious transactions." The new target price is about 32% lower than the closing price on July 1.

JPMorgan warns that negotiations with current and potential clients are likely to become more difficult due to reputational damage. Bernstein analysts say that "in a worst-case scenario, reputational damage could threaten Worldline's regulatory status," although analysts view this as an unlikely outcome. 

Fintelegram writes that the investigation could have serious consequences for Worldline. If violations of European regulations such as the PSD2 transaction monitoring directive, AMLD5 anti-money laundering directive and KYC (know your customer) rules are confirmed, the company could face fines of up to 10% of its annual turnover in each EU country where violations occurred;

In addition, if Worldline deliberately assigned "clean" codes to dubious clients - for example, online casinos or adult sites - disguising them as cafes or stores, for example, this could lead to blocking by international payment systems. In such a case, Worldline would lose access to Visa, Mastercard and other payment networks - without them, the company would not be able to process transactions.

So far, following journalistic reports, only the Brussels prosecutor's office has opened an investigation into possible money laundering against Worldline's Belgian unit only the Brussels prosecutor's office.

It remains to be seen whether the Worldline scandal will catalyze reforms in the fintech industry. But that's exactly what happened in 2020, when the Wirecard story changed the rules of the game in European fintech. After it emerged that the payment system operator had been falsifying reports for years, which was missed by the E&Y auditor, Germany introduced a law to increase transparency and accountability (FISG), expanded BaFin's powers, increased oversight of auditors, and required companies to disclose third-party and off-balance-sheet liabilities. 

"Worldline's subsidiary Payone, for example, operates in several jurisdictions - Germany and the Netherlands. This means that enforcement may affect several national regulators at once: the German BaFin, the Dutch DNB and the French financial supervisory authority ACPR. All of them have the power to require capital increases, impose restrictions on licenses or suspend individual units.

This article was AI-translated and verified by a human editor